All Flashcards

Question

Lamda Features

Answer 1

1. Supports popular programming languages like Java, Go, PowerShell, Node.js, C#, Python, and Ruby. 2. You author code using your favorite development environment or via the console. 3. Lambda can execute your code in response to events. 4. Lambda functions have a 15-minute timeout.

Answer 2

Compute time - only pay for compute time used Request count - a request is counted each time it starts execution (test invoked in console counts as well) Free tier - 1 mm request each month

Answer 3

Compute time - only pay for compute time used Request count - a request is counted each time it starts execution (test invoked in console counts as well) Free tier - 1 mm request each month (always free even after free usage tier expires)

Answer 4

Manage containers like dockers Scales automatically Serverless

Answer 5

Deploy preconfigured applications, like WordPress websites Includes a virtual machine, SSD-based storage, data transfer, DNS management, and a static IP Simple screens for people with no cloud experience Provides a low, predictable monthly fee, as low as $3.50

Answer 6

you to run cloud services in your internal data center. Hybrid experience AWS delivers and installs cloud in on prem data center Access to cloud service and API to develop app on premise Support workload that needs to remain on premise due to latency or sovereignty needs

Answer 7

process large workloads in smaller chunks (or batches). Dynamically provisions instances based on volume Runs hundreds and thousands of smaller batch processing jobs

Answer 8

*****S3 is a regional service, but bucket names must be globally unique. Objects (or files) are stored in buckets (or directories). Essentially unlimited storage that can hold millions of objects per bucket You can upload objects via the console, the CLI, or programmatically from within code using SDKs. Objects can be public or private. You can enable versioning to create multiple versions of your file in order to protect against accidental deletion and to use a previous version

Answer 9

You can set security at the bucket level or individual object level using access control lists (ACLs), bucket policies, or access point policies.

Answer 10

You can use S3 access logs to track the access to your buckets and objects.

Answer 11

Durability - 11 9's Availability 5 9's

Answer 12

Data Stored across multiple Availability Zone Recommended for frequently accessed data

Answer 13

Automatically moves data to most cost effective storage Data Stored across multiple Availability Zone Recommended: data with unknown or changing access pattern

Answer 14

Data access less frequently but requires RAPID ACCESS Data Stored across multiple Availability Zone Recommended for: Long live data Infrequent access Milliseconds access when needed

Answer 15

Less frequently access but require rapid access Stored across multiple AZ Cheaper than S3 Standard Recommended for: Long-live data Infrequent access Millisecond access when needed

Answer 16

Long-term data/archival Data retrieval takes longer 3 retrieval options: 1-5 minutes 3-5 hours 5-12 hours Stored across multiple AZ *Cheap storage option/long term backup

Answer 17

Like S3 Glacier but longer to access 12 hours or 48 hours Cheapest of all S3 options Data stored across multiple AZ Long term data archival - access once or twice a year retaining data for regulatory compliance

Answer 18

Provides object storage on premise single storage class data stored across multiple devices and servers Data that needs to be kept locally/demanding applications performance needs.

Answer 19

Data persist when instance not running tied on one AZ can ONLY be attached to ONE instance in the same AZ Recommended for: quick access Running db on an instance long term data storage

Answer 20

storage on disk PHYSICALLY attached to an instance faster I/O speed storage is TEMPORARY, when instance stopped, data is loss Recommended: Temp storage needs Data replicated across multiple instances

Answer 21

ONLY supports Linux More expensive than EBS Accessible across different AZ zone in the same Region Recommended: Main directories for business critical apps Lift/shift existing enterprise apps

Answer 22

Connect on premise/cloud Supports Hybrid model Recommended: Moving backup to clouds reduce cost for hybrid cloud storage Low latency access to data

Answer 23

Integrates with EC2, EBS, EFS Create backup plan - frequency/retention

Answer 24

**Global distribution of content ****Makes content global or restrict it based on location Content Delivery Network that delivers data and application globally with low latency Can stop DDOS attack *Speeds up delivery of static and dynamic web content *Use edge location to cache content

Answer 25

***Sends traffic through AWS global network infrastructure Improve latency/avail on single-region applications 60% performance boost Automatically re-routes traffic to health regional endpoints.

Answer 26

***Fast transfer of file over long distance Use CloudFront globally distributed edge location Customers around the world can upload to a central bucket

Answer 27

A VPC spans Availability Zones in a Region foundational service that allows you to create a secure private network in the AWS cloud where you launch your resources. Launch resources like EC2 instances inside the VPC Isolate and protect resources

Answer 28

Don't forget an internet gateway allows traffic to the public internet and peering connects 2 VPCs together.

Answer 29

DNS service that routes users to applications. ***Performs health checks on AWS resources Domain name registration Supports hybrid cloud architectures

Answer 30

Direct Connect is a dedicated physical network connection from your on-premises data center to AWS. ***Supports a hybrid environment Data travels over a private network Dedicated physical network connection

Answer 31

Site-to-Site VPN creates a secure connection between your internal networks and your AWS VPCs. ***Supports a hybrid environment Similar to Direct Connect, but data travels over the public internet Data is automatically encrypted Connects your on-premises data center to AWS

Answer 32

API Gateway allows you to build and manage APIs. Share data between systems Integrate with services like Lambda

Answer 33

service that makes it easy to launch and manage relational databases. Supports popular database engines Offers high availability and fault tolerance using Multi-AZ deployment option AWS manages the database with automatic software patching, automated backups, operating system maintenance, and more. Launch read replicas across regions in order to provide enhanced performance and durability

Answer 34

Aurora is a relational database compatible with MySQL and PostgreSQL that was created by AWS 5x faster than normal MySQL and 3x faster than normal PostgreSQL Scales automatically while providing durability and high availability Managed by RDS

Answer 35

DynamoDB is a fully managed NoSQL key-value and document database. ***NoSQL key-value database Fully managed and serverless Non-relational Scales automatically to massive workloads with fast performance

Answer 36

DocumentDB is a fully managed document database that ****supports MongoDB. Fully managed and serverless Non-relational

Answer 37

ElastiCache is a fully managed in-memory datastore compatible with Redis or Memcached. ****In-memory datastore Data can be lost Offers high performance and low latency

Answer 38

Neptune is a fully managed graph database that supports highly connected datasets. ***create social media graph Graph database service Supports highly connected datasets like social media networks Fully managed and serverless Fast and reliable

Answer 39

DMS helps you migrate databases to or within AWS. Migrate on-premises databases to AWS Continuous data replication Supports homogeneous and heterogeneous migrations Virtually no downtime

Answer 40

SMS allows you to migrate on-premises servers to AWS. Migrates on-premises servers to AWS Server saved as a new Amazon Machine Image (AMI) Use AMI to launch servers as EC2 instances

Answer 41

8 terabytes of usable storage Offline shipping Online with DataSync

Answer 42

Petabyte-scale data transport solution Transfer data in and out ***Cheaper than internet transfer ***Snowball Edge supports EC2 and Lambda

Answer 43

Multi-petabyte or exabyte scale Data loaded to S3 Securely transported

Answer 44

DataSync allows for online data transfer from on-premises to AWS storage services like S3 or EFS. Migrates data from on-premises to AWS Copy data over Direct Connect or the internet Copy data between AWS storage services ***Replicate data cross-Region or cross-account

Answer 45

Redshift is a scalable data warehouse solution. Handles exabyte-scale data

Answer 46

Amazon WorkSpaces provides a Desktop as a Service (DaaS) solution. https://aws.amazon.com/workspaces/?workspaces-blogs.sort-by=item.additionalFields.createdDate&workspaces-blogs.sort-order=desc

Answer 47

Web Application Firewall (WAF) AWS Shield Route 53 CloudFront

Answer 48

Under the Shared Responsibility Model, AWS takes responsibility for managing all the hardware (including access, patching, and other maintenance) and software required to deliver the service — which in this case is the EC2 instance. Anything to do with the instance itself is the responsibility of the customer

Answer 49

The platform-as-a-service model removes the need for organizations to manage the underlying infrastructure (usually hardware and operating systems) and allows you to focus on the deployment and management of your applications.

Answer 50

Security group - The security group acts as a virtual firewall to protect the EC2 instance.

Answer 51

Create an identity-based policy. & Add the user to the group that has the necessary permission policy. By default, an IAM user can’t access anything in the AWS account. So, the inability to perform the RDS actions on the Clients table is not a technical or password issue. To grant access, you would need to create an identity-based policy.

Answer 52

Low utilization on EC2 instances S3 bucket permissions for public access Exposed access keys

Answer 53

Region Username

Answer 54

Bucket policies - Bucket policies allow you to control access to entire buckets.

Answer 55

S3 Bucket Elastic Load Balancer Domain Name

Answer 56

Increased application availability Protection against network and application layer attacks via WAF Lower latency for customers of your e-commerce website

Answer 57

Elastic Beanstalk Elastic Beanstalk allows you to deploy your web applications and web services to AWS. https://aws.amazon.com/elasticbeanstalk/

Answer 58

Aurora MariaDB

Answer 59

AWS Personal Health Dashboard AWS Personal Health Dashboard gives you a personalized view of the status of services and resources used by your applications.

Answer 60

Oracle to Amazon Aurora PostgreSQL Microsoft SQL Server to Amazon Aurora PostgreSQL

Answer 61

AWS Cost Explorer Cost Explorer allows you to visualize and forecast your costs and usage over time.

Answer 62

Trusted Advisor - Trusted Advisor has a service limit dashboard that helps you monitor service limits. CloudWatch - CloudWatch Alarms can be used to determine the percentage of utilization versus the limit.

Answer 63

Inspector works with EC2 instances to uncover and report vulnerabilities.

Answer 64

Replace upfront capital expenses with low variable costs. All the hardware purchased upfront for a data center will be replaced by resources that are variable in nature with low upfront costs. https://d1.awsstatic.com/whitepapers/introduction-to-aws-cloud-economics-final.pdf

Answer 65

Managed Services Managed Services helps you efficiently operate your AWS infrastructure and reduces operational risks and overhead.

Answer 66

AWS Marketplace Marketplace is a digital catalog of prebuilt solutions you can purchase or license. You may also use it to sell solutions to others. https://aws.amazon.com/marketplace?aws=hp

Answer 67

Upgrade to Enterprise plan. AWS Infrastructure Event Management is a structured program available to Enterprise Support customers (and Business Support customers for an additional fee) that helps you plan for large-scale events, such as product or application launches, infrastructure migrations, and marketing events. https://aws.amazon.com/premiumsupport/programs/iem/#:~:text=AWS%20Infrastructure%20Event%20Management%20is,infrastructure%20migrations%2C%20and%20marketing%20events.

Answer 68

Fargate Lamba S3 DynamoDB EC2 is not serverless

Answer 69

A Region is a geographical area of the world that is a collection of data centers logically grouped into Availability Zones. Availability Zones (AZs) consist of 1 or more physically separated data centers.

Answer 70

Utilize a multi-Region deployment when deploying the application. Deploy the application to span across multiple Availability Zones (AZs). NOT - While CloudFront speeds up the global delivery of static content, it alone doesn't ensure high availability.

Answer 71

The Auto Scaling group can be used to scale out and scale in the instances as the demand dictates. This will save money and avoid having instances sitting idle for long periods of time. AWS Auto Scaling monitors your applications and automatically adjusts your capacity to maintain steady, predictable performance at the lowest possible cost. Using AWS Auto Scaling, it’s easy to set up application scaling for multiple resources across multiple services in minutes. https://aws.amazon.com/autoscaling/

Answer 72

A CloudWatch alarm can be set up to monitor CPU utilization and trigger further action. Further action could be an Auto Scaling group adding another EC2 instance and/or using SNS to notify team members of the occurrence.

Answer 73

Configure the load balancer to serve traffic to multiple Availability Zones. You would set up the load balancer to deliver traffic across multiple Availability Zones

Answer 74

Edge location An edge location uses cached copies of your content for fast delivery to users. Don't forget CloudFront speeds up delivery using edge locations.

Answer 75

AWS Trusted Advisor Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices. https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

Answer 76

Macie uses machine learning to discover sensitive data stored on Amazon S3. Macie automatically detects a large and growing list of sensitive data types, including personally identifiable information (PII) such as names, addresses, and credit card numbers.

Answer 77

While Athena is a query service for S3 that allows the use of standard SQL, Athena does not automatically and continually query S3 for sensitive data.

Answer 78

IAM policy Policies can be attached to a group to ensure all users in the group have the same access. AWS even has a managed policy, Administrator Access, you can use.

Answer 79

IAM roles are not associated with a specific user or group. Roles are meant to be assumed by anyone who needs it for a temporary period of time.

Answer 80

Identity and Access Management (IAM) - IAM allows you to create and manage access keys for an IAM user. NOT - Systems Manager - Systems Manager gives you visibility into and control over your AWS resources.

Answer 81

Use an instance profile to pass an IAM role with Amazon S3 permissions to the EC2 instance The company will need to create a role that grants access to S3 and associate it with the instance.

Answer 82

The IAM credential report lists all the users and the status of their various credentials, including passwords, access keys, server certificates, and MFA devices.

Answer 83

Deploy smaller, reversible changes. This is a design principle related to operational excellence. Smaller changes can easily be reverted, if necessary.

Answer 84

Service control policies (SCPs) AWS Organizations provides central governance and management for multiple accounts. Organization SCPs allow you to create permissions guardrails that apply to all accounts within a given organization. Service control policies (SCPs)

Answer 85

Secrets Manager Secrets Manager allows you to manage and retrieve secrets (passwords or keys).

Answer 86

AWS Kinesis Kinesis allows you to analyze data and video streams in real time. https://aws.amazon.com/kinesis/ AWS CloudTrail CloudTrail tracks user activity and API calls within your account. https://aws.amazon.com/cloudtrail/

Answer 87

In multiple Availability Zones within the Region you select Any object uploaded to S3 is automatically stored in multiple Availability Zones in the Region in which it was uploaded. This means that if any single AZ in a Region is experiencing issues, objects stored in S3 will still be available. Although objects in S3 can be made to be accessible globally, by default they are always stored in a redundant fashion in only the Region they were uploaded, ruling out the other answers. https://aws.amazon.com/s3/

Answer 88

Networking and Content Delivery Amazon Virtual Private Cloud (Amazon VPC) gives you full control over your virtual networking environment, including resource placement, connectivity, and security. VPC can be found under the Networking and Content Delivery category of services in the AWS Management Console. AWS Networking and Content Delivery Services.

Answer 89

By default, all subnets within a VPC can communicate with each other. By default, all subnets within a VPC can communicate with each other, without needing any other resources or configuration. https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html

Answer 90

By adding or removing EC2 instances from your EC2 fleet based on conditions you specify Auto Scaling allows you to automatically add or remove EC2 instances based on conditions you specify - these can include such things as at a specific time, or depending on how busy your application is. Auto Scaling cannot change the size of existing instances, nor can it add or change storage on an instance. https://aws.amazon.com/autoscaling/

Answer 91

Snowmobile The Snow Family allows you to transfer large amounts of on-premises data to AWS using a physical device. Snowmobile transports multi-petabyte or exabyte-scale data.

Answer 92

Other private subnets in the same VPC By default, a private subnet can only communicate with other subnets in the same VPC, be they private or public. In order to communicate to the internet, a NAT gateway and internet gateway are required, and to enable communication between subnets in different VPCs, the VPCs must first be peered. https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#vpc-subnet-basics Public subnets in the same VPC By default, a private subnet can only communicate with other subnets in the same VPC, be they private or public. https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#vpc-subnet-basics

Answer 93

Database Migration Service DMS supports homogeneous migrations like Oracle to Oracle and heterogeneous migrations like Oracle to Aurora, with minimal downtime. NOT - DataSync While DataSync provides online data transfer from on-premises to services like S3 or EFS, DataSync doesn't convert from one database engine to another.

Answer 94

Amazon Redshift Amazon Redshift provides the best solution for performing queries based on a predefined set of dimensions. Redshift organizes data for high performance based on user-specified distribution schemes. Amazon ElastiCache provides in-memory performance, but no data organization assistance. Amazon Aurora and Amazon DynamoDB are good solutions, but Redshift's columnar storage gives it the edge. Amazon Redshift

Answer 95

S3 One Zone-Infrequent Access S3 One Zone-Infrequent Access is designed for customers who want a lower cost option for infrequently accessed data but do not require the multiple Availability Zone data resilience model of the S3 Standard or S3 Standard-Infrequent Access storage classes. S3 One Zone-Infrequent Access provides millisecond access when the data is needed.

Answer 96

SageMaker SageMaker helps you build, train, and deploy machine learning models quickly.

Answer 97

AWS Application Discovery Service AWS Application Discovery Service helps you gather information about your on-premises environment and is considered a migration tool. https://aws.amazon.com/cloud-migration/ AWS Snowball Snowball helps you migrate massive amounts of data into cloud, so it is considered a migration tool. https://aws.amazon.com/cloud-migration/

Answer 98

No - by default, buckets and their contents are private By default, all data stored in S3 is not viewable by the public. If you want a bucket or object to be accessible by the public, you must explicitly make it so. NAT gateways and internet gateways are needed to allow communications between VPCs and the internet, but they are not required when it comes to S3. https://aws.amazon.com/s3/faqs/#security

Answer 99

Rekognition The company can use Rekognition to identify objects like protective equipment in their images and detect if employees are wearing the required protective equipment.

Answer 100

Business Support Business Support is the minimum plan that provides access to the full set of Trusted Advisor checks.

Answer 101

Hardware and infrastructure - The company should consider the cost of the hardware, like physical servers. Data center cooling, power, and space requirements - The company should consider how much it costs to power its data center. Software license costs - The company should consider the number of licenses and the cost of the licenses.

Answer 102

Contact the Support Concierge team. - The Concierge agent is the primary point of contact for billing or account inquiries. Use the AWS Support API to programmatically open a case with AWS Support. - Customers on the Enterprise Support plan have access to the AWS Support API to create, manage, and close support cases.

Answer 103

The company can use the AWS Pricing Calculator. The Pricing Calculator provides an estimate of AWS fees and charges. Since the company knows the workload details, the AWS Pricing Calculator can also help with calculating the total cost of ownership.

Answer 104

Control Tower - Control Tower helps you ensure your accounts conform to company-wide policies. Control Tower actually sits on top of Organizations. Organizations - Organizations allows you to centrally manage multiple AWS accounts under 1 umbrella. You can allocate resources and apply policies across accounts.

Answer 105

Enterprise Support provides access to a Technical Account Manager (TAM) who helps coordinate access to subject matter experts among other things.

Answer 106

< 1 hour response time support when your production system goes down. The Business level support plan provides 1 hour or less response time support for production-level failures. https://aws.amazon.com/premiumsupport/plans/

Answer 107

AWS SQS SQS is a message queuing service that allows you to build loosely coupled systems. https://aws.amazon.com/sqs/

Answer 108

SES is an email service that allows you to send richly formatted HTML emails from your applications.

Answer 109

Provision resources to the Asia Pacific (Sydney) Region in Australia. A multi-Region deployment solves the issue by deploying the application closest to the user base.

Answer 110

A Region is a geographic area that hosts 2 or more Availability Zones. https://aws.amazon.com/about-aws/global-infrastructure/

Answer 111

IAM Identity and Access Management is a global service.

Answer 112

Go global in minutes Stop spending money running and maintaining data centers.

Answer 113

Automation Infrastructure as Code is a key implementation of automation in cloud - using Infrastructure as Code allows you to quickly and easily deploy and manage your environment without reliance on humans to complete all the tasks.

Answer 114

CloudFront Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds, all within a developer-friendly environment. https://aws.amazon.com/cloudfront/

Answer 115

There are more Availability Zones than Regions. Regions contain 2 or more Availability Zones, which are themselves made up of 1 or more data centers. This means there will always be more AZs than Regions. Edge locations are separate from AZs and Regions, and there are more Edge Locations than Regions and Availability Zones. https://aws.amazon.com/about-aws/global-infrastructure/regions_az/?p=ngi&loc=2

Answer 116

Each AWS Region consists of multiple, isolated, and physically separate AZs within a geographic area. AWS has the concept of a Region, which is a physical location around the world where we cluster data centers. We call each group of logical data centers an Availability Zone. Each AWS Region consists of multiple, isolated, and physically separate AZs within a geographic area. Unlike other cloud providers, that often define a region as a single data center, the multiple-AZ design of every AWS Region offers advantages for customers. Each AZ has independent power, cooling, and physical security and is connected via redundant, ultra-low-latency networks. AWS customers focused on high availability can design their applications to run in multiple AZs to achieve even greater fault tolerance. AWS infrastructure Regions meet the highest levels of security, compliance, and data protection.

Answer 117

Scalability This is an example of scalability, which means systems are expected to grow over time with no drop in performance.

Answer 118

Regions are generally specific geographical areas. Regions are made up of Availability Zones. A Region is a geographical area divided into Availability Zones. Each Region contains at least 2 publicly accessible Availability Zones.

Answer 119

Public cloud With the public cloud, all resources run in the cloud. Don't forget: This is the AWS Cloud.

Answer 120

AWS Command Line Interface (CLI) AWS Management Console Application code

Answer 121

Customer Service Policy for Penetration Testing AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for Amazon EC2 instances, NAT gateways, elastic load balancers, and 7 other services. Reference: Penetration Testing.

Answer 122

Collecting monitoring data to debug failures Using AWS encryption solutions to protect data Taking database backups Creating and managing database users

Answer 123

Nowhere — you should not use the root user access keys for this. It is not recommended to use the root user account or access keys for any reason, as these grant full unrestricted access to the entire account. Recommended practice is to follow the concept of "least privilege" and create am IAM user or role with just enough access to do what is needed and nothing more, and use those keys as required. https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html

Answer 124

AWS Trusted Advisor AWS Trusted Advisor can help you assess the fault tolerance of your AWS environment. AWS Inspector can help you assess your security. https://aws.amazon.com/premiumsupport/trustedadvisor/

Answer 125

ElastiCache ElastiCache helps you alleviate database load for data that is accessed often. ElastiCache is a great way to cache common queries.

Answer 126

On-Demand On-Demand is good for applications that have unpredictable workloads that can't be interrupted. NOT - EC2 Spot Since the application running on an EC2 Spot Instance can be randomly interrupted, EC2 Spot is not the best choice.

Answer 127

Amazon CloudWatch CloudWatch is a collection of services that help you monitor and observe your cloud resources. https://aws.amazon.com/cloudwatch/ NOT Amazon CloudTrail CloudTrail tracks user activity and API calls within your account. https://aws.amazon.com/cloudtrail/

Answer 128

SQS Amazon SQS is a message queue service used by distributed applications to exchange messages through a polling model and can be used to decouple sending and receiving components. Amazon SQS also provides extremely high message durability, ensuring messages are not lost if your software systems fail.

Answer 129

Amazon SES (Amazon Simple Email Service) is a flexible, affordable, and highly scalable email messaging platform for businesses and developers. Amazon SES is not a queuing system — it doesn't ensure messages are not lost if your software systems fail.

Answer 130

Convertible Reserved Instance (RI) with a capacity reservation A Reserved Instance is a reservation of resources and capacity for either 1 or 3 years. A capacity reservation offers assurance that the customer will be given preference if there is ever a capacity constraint in a Region. On-demand capacity reservation On-Demand Capacity Reservations enable you to reserve compute capacity for your Amazon EC2 instances for any duration.

Answer 131

Application Load Balancer An Application Load Balancer is best suited for load balancing of HTTP and HTTPS traffic and provides advanced request routing targeted at the delivery of modern application architectures, including microservices and containers. https://aws.amazon.com/elasticloadbalancing/ NOT - Network Load Balancer A Network Load Balancer is best suited for load balancing of Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Transport Layer Security (TLS) traffic where extreme performance is required. https://aws.amazon.com/elasticloadbalancing/

Answer 132

AWS CloudFormation AWS CloudFormation is a service that helps you model and set up your Amazon Web Services resources so you can spend less time managing those resources and more time focusing on your applications that run in AWS. https://aws.amazon.com/cloudformation/ NOT - Elastic Beanstalk AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS. This is not what you are investigating. https://aws.amazon.com/elasticbeanstalk/

Answer 133

Web Application Firewall (WAF) WAF helps protect your web applications against common web attacks like SQL injection attacks and cross-site scripting. NOT - Shield Advanced Shield is a managed Distributed Denial of Service (DDoS) protection service.

Answer 134

Global Accelerator can improve the experience by routing player traffic along with the private AWS global network to the fastest instance of your application. Player traffic is not negatively impacted by internet congestion and local outages.

Answer 135

An internet gateway enables resources inside your VPC to reach the internet, as long as route tables and IP addresses are correctly configured in your environment. https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html

Answer 136

Cloud9 allows application developers to write code within an integrated development environment (IDE) from within their web browser.

Answer 137

Infrastructure Event Management Infrastructure Event Management provides support for planning and running business-critical events. NOT - Professional Services Professional Services helps enterprise customers move to a cloud-based operating model.

Answer 138

AWS Cost Explorer Cost Explorer allows you to visualize and forecast your costs and usage over time. NOT - Cost and Usage Report The Cost and Usage Report contains the most comprehensive set of cost and usage data.

Answer 139

Disposable resources Working in a traditional infrastructure environment means you have to deal with fixed resources, which is comparatively costly and labor-intensive. By contrast, AWS services are much more convenient; the services provide the ability to use as many resources as you need and dispose of them when you no longer need them. That’s why such resources are both temporary and disposable. Temporary resources Working in a traditional infrastructure environment means you have to deal with fixed resources, which is comparatively costly and labor-intensive. By contrast, AWS services are much more convenient; the services provide the ability to use as many resources as you need and dispose of them when you no longer need them. That’s why such resources are both temporary and disposable.

Answer 140

Amazon Elastic Compute Cloud (EC2) - EC2 allows you to rent and manage virtual servers in the cloud. AWS Elastic Beanstalk - Elastic Beanstalk allows you to deploy your web applications and web services to AWS. Although we covered Elastic Beanstalk in the "Deployment and Infrastructure Management Services" lesson, it is a compute service. AWS Lambda - Lambda is a serverless compute service that lets you run code without managing servers. NOT - Amazon Cognito - Amazon Cognito is a security service that allows you to add user authorization and authentication to your applications. Though we didn't officially go over Cognito, you may see a few service names on the exam that we didn't truly cover. Please make sure you read the "Overview of Amazon Web Services" whitepaper whitepaper before the exam.

Answer 141

Infrastructure as a Service (IaaS) - IaaS offers building blocks that can be rented. When you pay a web hosting fee, you're using IaaS. NOT - Platform as a Service (PaaS) - PaaS is often used by developers to develop software using web-based tools.

Answer 142

By replacing large capital expenditures with lower variable costs spread over time

Answer 143

Platform as a Service (PaaS) -PaaS is often used by developers to develop software using web-based tools. NOT - Software as a Service (SaaS) SaaS allows you to use a complete application on demand. When you access your personal email through a web browser, you're using SaaS.

Answer 144

Apply security at all layers - Apply security at all layers is one of the security pillar design principles that can help you strengthen your workload's security in the cloud. AWS Documentation: AWS Well-Architected Framework > Security Foundations. Enable traceability Protect data in transit and at rest

Answer 145

Route 53 Elastic Load Balancing CloudFront NOT GuardDuty - GuardDuty is an intelligent threat detection system that uncovers unauthorized behavior.

Answer 146

Create an IAM role with appropriate permissions and assign it to the instance. You should use IAM roles wherever possible to enable applications running on EC2 instances to access other AWS resources. This is the most secure method to do so. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html NOT - Create an IAM group with appropriate permissions and assign it to the instance. It is not possible to assign an IAM group or user to an instance.

Answer 147

Modifying the support plan Configuring an Amazon S3 bucket to enable MFA (multi-factor authentication) delete Activate IAM access to the Billing and Cost Management console Changing the email address associated with the account

Answer 148

API calls AWS CLI AWS SDKs

Answer 149

Implement cloud financial management. Utilize consumption-based pricing Measure overall efficiency

Answer 150

Access key When working with AWS from the CLI, you need to provide an access key and secret access key.

Answer 151

Amazon Inspector You will need to turn to Amazon Inspector for security assessment. Not only does it identify vulnerabilities in your application, it will also spot deviations from security best practices. AWS Shield and WAF protect the application from attacks that exploit vulnerabilities, rather than identify them. Trusted Advisor only provides recommendations on how to improve security. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html

Answer 152

CloudHSM CloudHSM allows customers to meet compliance requirements for data security by using dedicated hardware.

Answer 153

Elastic Beanstalk - Elastic Beanstalk monitors application health via a health dashboard. Elastic Load Balancing - Load balancers monitor the health of EC2 instances and route the traffic to only instances that are in a healthy state. Route 53 - Route 53 can be used to configure DNS health checks to route traffic to healthy endpoints or to monitor the health of your applications.

Answer 154

Elastic Block Store Elastic Block Store is a storage service - all others are compute services.

Answer 155

Neptune Neptune is a fully managed graph database that supports highly connected datasets.

Answer 156

EMR EMR is a service that makes it easy to process large amounts of data efficiently. https://aws.amazon.com/emr/

Answer 157

CloudFormation allows you to provision AWS resources using Infrastructure as Code (IaC). https://aws.amazon.com/cloudformation/ NOT - OpsWorks allows you to use Chef or Puppet to automate the configuration of your servers and deploy code. https://aws.amazon.com/opsworks/

Answer 158

AWS X-Ray AWS X-Ray provides an end-to-end view of requests as they travel through your application, and shows a map of your application’s underlying components. You can use X-Ray to analyze from simple three-tier applications to complex microservices applications consisting of thousands of services. https://aws.amazon.com/xray/

Answer 159

Elastic MapReduce (EMR) EMR helps you process large amounts of data using big data frameworks like Hadoop. NOT - Kinesis allows you to analyze data and video streams in real time.

Answer 160

A virtual hard disk in the cloud An EBS volume is best described as a virtual hard disk in the cloud - storage that, for all intents and purposes, appears to be directly attached to your instance. These are used by the virtual server instances in the cloud, which are known as EC2 instances. https://aws.amazon.com/ebs/

Answer 161

CloudFormation CloudFormation allows you to provision AWS resources using Infrastructure as Code (IaC) and reusable templates. https://aws.amazon.com/cloudformation/resources/templates/

Answer 162

CodePipeline CodePipeline automates the software release process. https://aws.amazon.com/codepipeline/

Answer 163

Redshift Redshift allows you to run complex analytic queries against petabytes of structured data, using sophisticated query optimization, columnar storage on high-performance local disks, and massively parallel query execution. https://aws.amazon.com/redshift/

Answer 164

Amazon DocumentDB Amazon DocumentDB (with MongoDB compatibility) is a fast, scalable, highly available, and fully managed document database service that supports MongoDB workloads. As a document database, Amazon DocumentDB makes it easy to store, query, and index JSON data. Amazon DocumentDB (with MongoDB compatibility) FAQs.

Answer 165

Spot Instances Spot Instances are usually the most cost-effective solution for workloads that can be interrupted. On-Demand and Reserved Instances are both more expensive in this use case, and Custom Instances do not exist. https://aws.amazon.com/ec2/spot/

Answer 166

AWS Trusted Advisor Trusted Advisor can assist you with the cost optimization of your AWS environment. [https://aws.amazon.com/premiumsupport/trustedadvisor/

Answer 167

EBS EBS volumes are "virtual hard disks" for your EC2 instance. https://aws.amazon.com/ebs/

Answer 168

Business The Business plan is the cheapest plan that will still provide the full set of Trusted Advisor checks. https://aws.amazon.com/premiumsupport/plans/

Answer 169

Cost Allocation Tags A tag is a label that you or AWS assign to an AWS resource. Each tag consists of a key and a value. Tagged resources can appear on the Cost Explorer or on a cost allocation report. https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

Answer 170

Basic Developer Business Enterprise

Answer 171

Business Support Business Support is the minimum plan that provides access to support via telephone.

Answer 172

AWS Concierge For AWS Enterprise customers, the AWS Concierge is a resource dedicated to answering billing and account questions. https://www.amazonaws.cn/en/support/features/

Answer 173

Convertible These can be exchanged during the term for another Convertible Reserved Instance with new attributes, including instance family, instance type, platform, scope, or tenancy. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/reserved-instances-types.html

Answer 174

An S3 bucket you own You can use Cost and Usage Reports to publish your AWS billing reports to an S3 bucket you own. AWS updates the report in your bucket once a day in comma-separated value (CSV) format. You can view the reports using spreadsheet software or access them from an application using the Amazon S3 API. https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html

Answer 175

Business The Business and Enterprise support plans, the two most expensive plans, offer 24 X 7 support via phone or chat. https://aws.amazon.com/premiumsupport/plans/

Answer 176

Business The Business and Enterprise support plans, the two most expensive plans, offer 24 X 7 support via phone or chat. https://aws.amazon.com/premiumsupport/plans/

Answer 177

Availability Zones Availability Zones (AZs) are connected among themselves in a single Region. They are physically separated, connected through low-latency links, fault tolerant, and allow high availability.

Answer 178

Infrastructure as a Service (IaaS) IaaS offers building blocks that can be rented. EC2 is an example of IaaS.

Answer 179

Platform as a Service (PaaS) Software as a Service (SaaS) Infrastructure as a Service (IaaS)

Answer 180

A distinct location within a geographic area designed to provide high availability to a specific geography A Region is a distinct location within a geographic area designed to provide high availability to a specific geography. Regions are a key concept in AWS' Global Infrastructure — each is made up of 1 or more isolated (within that Region) Availability Zones. There are often multiple AWS Regions on each continent, such as North America. https://aws.amazon.com/about-aws/global-infrastructure/

Answer 181

AWS Shield Advanced AWS Shield Advanced provides enhanced protections and 24/7 access to AWS experts for a fee.

Answer 182

AWS Trusted Advisor Trusted Advisor helps you optimize your entire AWS environment in real-time following AWS best practices. It helps you optimize cost, fault tolerance, and more. https://aws.amazon.com/premiumsupport/trustedadvisor/ NOT AWS Inspector Inspector works with EC2 instances to uncover and report vulnerabilities.

Answer 183

Network ACL A network access control list (NACL) is an optional layer of security for your VPC that ensures the proper traffic is allowed into the subnet. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Answer 184

Use IAM policies You manage permissions for IAM users, groups, and roles by creating a policy document in JSON format and attaching it. Use IAM groups Using IAM groups lets you create a list of pre-defined permissions that any user made a part of that group will be granted. Roles are primarily used to grant AWS resources permissions to other AWS resources and generally are not for end-users. Reference: IAM User Groups

Answer 185

Create an IAM role and have the application assume the role. Roles define access permissions and are temporarily assumed by an IAM user or service. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html

Answer 186

Access keys Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK). Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). Like a user name and password, you must use both the access key ID and secret access key together to authenticate your requests. Managing access keys for IAM users. NOT - Security token Security tokens provide limited, short-term access for IAM users or federated (outside) users. https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html

Answer 187

AWS is responsible for ensuring malicious traffic does not impair the network hardware. The customer is responsible for ensuring unwanted traffic does not reach the EC2 instance. The customer is responsible for ensuring malicious traffic does not reach the EC2 instance. Under the Shared Responsibility Model, AWS takes responsibility for managing all the hardware (including access, patching, and other maintenance) and software required to deliver the service. In this scenario, AWS is responsible for the underlying network hardware, not the customer. However, the customer is responsible for ensuring that only wanted, valid traffic reaches their EC2 instance through the use of security groups, access control lists, or software firewalls. https://aws.amazon.com/compliance/shared-responsibility-model/

Answer 188

Amazon Inspector Amazon Inspector is an automated vulnerability management service that continually scans Amazon Elastic Compute Cloud (EC2) and container workloads for software vulnerabilities and unintended network exposure. Reference: Amazon Inspector FAQs

Answer 189

IAM policy simulator The IAM policy simulator allows you to test and troubleshoot identity-based policies, IAM permissions boundaries, service control policies (SCPs), and resource-based policies. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

Answer 190

An IAM user in the same AWS account as the role. A web service offered by AWS. An IAM user in a different AWS account than the role.

Answer 191

OpsWorks OpsWorks allows you to use Chef or Puppet to automate the configuration of your servers and deploy code on-premises or the cloud.

Answer 192

Static web hosting Storing application assets

Answer 193

Instance metadata This type of data is stored in instance metadata.

Answer 194

EC2 Instance Store An instance store is a local storage that is physically attached to the host computer and cannot be removed. Storage is temporary since data loss occurs when the EC2 instance is stopped.

Answer 195

Redshift Redshift is AWS' fully managed data warehouse solution. https://aws.amazon.com/redshift/

Answer 196

CloudFormation CloudFormation allows you to provision AWS resources using Infrastructure as Code (IaC). CloudFormation provides a repeatable process for provisioning resources like instances, load balancers, and S3 buckets.

Answer 197

Comprehend Comprehend is a natural language processing (NLP) service that uses machine learning to discover relationships and insights in text.

Answer 198

Storage Gateway Storage Gateway is a hybrid storage service that allows you to connect on-premises and cloud data.

Answer 199

It provides virtual computing environments. It supplies various configurations of CPU, memory, storage, and network capacity. You can use a preconfigured template called an Amazon Machine Image (AMI) to launch your instance. It provides scalable computing capacity in the AWS cloud.

Answer 200

Simple Email Service (SES) Amazon SES is an email service that allows you to send richly formatted HTML emails from your applications. It is the ideal choice for marketing campaigns or professional emails. Unlike SNS, SES sends HTML emails.

Answer 201

AWS Personal Health Dashboard AWS Personal Health Dashboard gives you a personalized view of the performance and availability of the AWS services underlying your AWS resources. https://aws.amazon.com/premiumsupport/phd/

Answer 202

Public IP address An EC2 instance in your VPC needs a public IP address for the internet gateway to route its traffic to the internet. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html

Answer 203

Spot Instance Spot Instances let you take advantage of unused EC2 capacity and are good for workloads that can be interrupted.

Answer 204

ElastiCache You can use ElastiCache to store the results of often-used queries, and this will allow quicker retrieval of this data. https://aws.amazon.com/elasticache/

Answer 205

AWS CodeCommit CodeCommit is a source control system for private Git repositories. https://aws.amazon.com/codecommit/

Answer 206

Elastic Load Balancing Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances. https://aws.amazon.com/elasticloadbalancing/

Answer 207

Track costs associated with your account and choose to be alerted when expenditures exceed your fixed target amount According to AWS, "You can use AWS Budgets to set a monthly cost budget with a fixed target amount to track all costs associated with your account. You can choose to be alerted for both actual (after accruing) and forecasted (before accruing) spends."

Answer 208

No upfront payments required Unpredictable workloads that cannot be interrupted You would use the EC2 On-Demand model when you need compute capability that does not require any up front payments or long term commitments, and where you have applications with short-term or unpredictable workloads that cannot be interrupted.

Answer 209

On-Demand This is not a long enough term to make Reserved Instances the better option. Plus, the application can't be interrupted, which rules out Spot Instances. NOT - Dedicated Dedicated Instances provide the option to bring along existing software licenses. The scenario does not indicate a need to do this.

Answer 210

Cost budget You need to create a cost budget with AWS Budgets if you want to monitor the cost of using your AWS services. https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html

Answer 211

On-Demand Instance It is a short-term project, which rules out Reserved Instances, and it has to run uninterrupted, which rules out Spot Instances. https://aws.amazon.com/ec2/pricing/ NOT - Dedicated Host The use of Dedicated Hosts is primarily for using existing software licenses. There is not enough information in the scenario to draw this conclusion. https://aws.amazon.com/ec2/pricing/

Answer 212

Spot Instances EC2 Spot Instances let you take advantage of unused EC2 capacity in the AWS Cloud. Spot Instances are available at up to a 90% discount compared to On-Demand prices. https://aws.amazon.com/ec2/spot/

Answer 213

Just start deploying the applications to the new Regions. You are free to deploy your applications to new Regions. Don't forget: CloudFormation can make the process of provisioning resources easier and repeatable.

Answer 214

Redirecting focus to innovation and invention Enabling the full elasticity of business operations Reducing procurement complexity

Answer 215

Availability Zone An Availability Zone (AZ) is one or more discrete data centers with redundant power, networking, and connectivity in an AWS Region. AZs are physically separated by a meaningful distance, many kilometers, from any other AZ, although all are within 100 km (60 miles) of each other. Availability Zones.

Answer 216

Elasticity Elasticity denotes the ability to increase or reduce the number or capabilities of AWS resources when needed. In this case, stopping or terminating instances means you are reducing the number of AWS resources used in your environment.

Answer 217

Private cloud Public cloud

Answer 218

Contact AWS and request a service limit increase. Use the Limits page in the Amazon EC2 console to request an increase in the limits for resources provided by Amazon EC2 or Amazon VPC on a per-Region basis. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html

Answer 219

AWS CloudTrail AWS CloudTrail provides visibility to API call activity for AWS infrastructure and other services. AWS Cloudwatch Logs might be part of a centralized logging solution, but all API event information will come from CloudTrail. AWS Systems Manager can process EC2 logs only, and AWS Compliance Manager is not a service offered by AWS. https://aws.amazon.com/cloudtrail/

Answer 220

Roles Access is assigned using policies and roles. Policies Access is assigned using policies and roles.

Answer 221

With a security group Security groups act as virtual firewalls for EC2 instances.

Answer 222

Identities Identities are the IAM resource objects that are used to identify and group. You can attach a policy to an IAM identity. These include users, groups, and roles. NOT Resources Resources are the user, group, role, policy, and identity provider objects that are stored in IAM. As with other AWS services, you can add, edit, and remove resources from IAM.

Answer 223

New security groups allow only outbound traffic and block all incoming traffic. By default, new security groups start with only an outbound rule to allow all traffic to leave the instances. You must add rules to enable any inbound traffic. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Answer 224

Security group A security group acts as a virtual firewall for your instance to protect your EC2 instance by controlling inbound and outbound traffic. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Answer 225

Entities IAM entities are the users (IAM users and federated users) and roles that are created and used for authentication. https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html

Answer 226

DNS query logs VPC Flow Logs AWS CloudTrail logs

Answer 227

Federated access Federated access is when you use an external directory, such as your corporate one, to grant users in that directory access to AWS resources. https://aws.amazon.com/identity/federation/

Answer 228

Secrets Manager Secrets Manager allows you to manage and retrieve secrets (passwords or keys).

Answer 229

AWS Trusted Advisor Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices. https://aws.amazon.com/premiumsupport/technology/trusted-advisor/ NOT AWS Inspector Inspector works with EC2 instances to uncover and report vulnerabilities. https://aws.amazon.com/inspector/

Answer 230

It is designed for storing petabytes of data. It is a data warehouse service.

Answer 231

It is compatible with the MySQL and PostgreSQL database engines. It uses the AWS Management Console, AWS CLI commands, and API operations to handle routine database tasks. You can handle routine database tasks on it using either the AWS Management Console, AWS CLI commands, or API operations. What is Amazon Aurora?

Answer 232

Database ElastiCache is an in-memory cache service used to improve database performance. This means that it saves your most common queries for quicker data retrieval rather than retrieving directly from your database. As a result, it is classified as an AWS Database service. AWS Documentation Amazon ElastiCache

Answer 233

Amazon Elastic Beanstalk Amazon Elastic Beanstalk is an example of a compute service. AWS Lambda AWS Lambda is an example of a compute service.

Answer 234

AWS Elastic Beanstalk Platform as a Service, or PaaS, enables the development, running, and management of applications on the cloud without the need to build and maintain an infrastructure. That is precisely what Elastic Beanstalk provides; it’s the ability to quickly deploy and manage applications in the AWS Cloud without worrying about the infrastructure that runs those applications. Reference: AWS Elastic Beanstalk

Answer 235

Trusted Advisor AWS Trusted Advisor is an online tool that provides you with real-time guidance to help you provision your resources following AWS best practices. https://aws.amazon.com/premiumsupport/trustedadvisor/ NOT - AWS Personal Health Dashboard Personal Health Dashboard provides alerts and guidance for AWS events that might affect your resources and applications.

Answer 236

Log files are encrypted With CloudTrail, you can create a trail that either applies to one Region or to all Regions. CloudTrail delivers log files within 15 minutes of account activity.

Answer 237

Lightsail Lightsail is ideal for simple websites or simple e-commerce applications. https://aws.amazon.com/lightsail/

Answer 238

A segment of a VPC’s IP address range where you can place groups of isolated resources. A virtual private cloud, or VPC, is the virtual network you create in your AWS account. When you create a VPC, you split it into smaller network segments by specifying a range of IP addresses. These segments are referred to as subnets, and this is where you launch your AWS resources. What Is Amazon VPC?.

Answer 239

Amazon Elastic Beanstalk Amazon Lightsail Amazon Elastic Compute Cloud (EC2)

Answer 240

AWS Key Management Service (KMS) - It is a managed service that enables you to easily create and control the keys used for cryptographic operations. AWS Secrets Manager - It is a secrets management service that helps you protect access to your applications, services, and IT resources. AWS Security- It provides you with a comprehensive view of your security state within AWS and your compliance with security standards and best practices.

Answer 241

CloudWatch The CloudWatch service is used to create billing alarms. NOT - Cost Explorer The Cost Explorer service is used to create custom reports that facilitate the understanding of the organization's costs and data usage.

Answer 242

AWS Budgets AWS Budgets notifies you when you exceed 85% of your Free Tier limits for each service you’re using by sending you an email. NOT AWS Cost Explorer Cost Explorer is actually a visualizer you can use to analyze your spend, but it does not alert you on your Free Tier usage.

Answer 243

The Dev team will be billed for 2 instances at On-Demand prices and 2 instances at the Reserved Instance price. Since the QA team has 5 Reserved Instances and only 3 are being used, that means 2 of the Reserved Instances are free. Since both teams belong to the same AWS Organization, the pricing for the 2 unused instances would be applied to 2 of the 4 Dev On-Demand instances.

Answer 244

Some AWS services are free for the first 12 months following the initial sign-up date to AWS. The AWS Free Tier offers some services for free for the first 12 months after signing up for an AWS account. It also offers free trials of select AWS services for a short period. So, usage is governed by these principles. Selected Some AWS services come with short-term free trial offers. The AWS Free Tier offers some services for free for the first 12 months after signing up for an AWS account. It also offers free trials of select AWS services for a short period. So, usage is governed by these principles.

Answer 245

Number of requests Duration and memory Data transfer

All Flashcards

(269 cards)